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O ' Abstract 

^ ■ We show that, one may take advantage of the asymmetry of channel noise. With appropriate 
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modifications to the standard protocols, both the key rate and the tolerable total channel noise 
can be increased if the channel noise is asymmetric. 
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I. INTRODUCTION 



Unlike classical key distribution, quantum key distribution (QKD) is built on the fact 



re state. The first 
is called BB84. 
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that measuring an unknown quantum state will almost surely disturb t 

published QKD protocol, proposed in by Bennett and Brassard in 1984 

For a history of the subject, one may refer to, for example, Ref. J3|. Since then, studies 

on QKD are extensive. Strict mathematical proofs for the unconditional security have been 

given alreadyJ4J, |8j, |9j, llCJ, |l3[. It is greatly simplified if one connects this with the quantum 



entanglement purification protocol (EPP) 4l. llll.ll2Ul3l|. 



To all QKD protocols, the first important requirement is the unconditional security, i.e., 
using whatever type of attack, eavesdropper (Eve) can never have non-negligible informa- 
tion to the final key shared by Alice and Bob. A conditional secure protocol without a 
testable condition is not so useful, since it is essentially same to the classical protocol on 
its security. In particular, one cannot depend the security on certain specific properties of 
physical channels, since those specific properties may be changed by Eve at the time the 
QKD protocol is running. For example, based on certain properties of the physical channel, 
Alice and Bob may take some physical treatment to decrease the error rate of their physical 
channel. Given such a treatment, suppose the error rate of the improved physical channel 
is given by the function of f{E ), and E is the error rate of the originally physical channel. 
Suppose in the QKD protocol Alice and Bob use the improved physical channel. It will be 
insecure if Alice and Bob in their QKD protocol only test the errors of the original physical 
and then use function / to calculate the error rate for the improved channel and then use 
the calculated value as the error rate. This is because, Eve may change the properties of 
the original physical channel and the mapping / could be incorrect then. However, it will 
be secure if Alice and Bob directly test the error rate of the improved physical channel and 
use the tested results as the input of error correction and privacy amplification. 

Besides the security requirement, we also hope to improve the feasibility of a protocol in 
practical use, e.g., the larger tolerable channel error rate and the key rate. Different from 
the security issue, one can improve the feasibility of a protocol based on the properties of 
physical channel. Alice and Bob may first investigate certain properties of their physical 
channel and then modify the protocol according to those properties of their physical channel. 
Given the specific properties of the physical channel, the modified protocol will have certain 



advantage, e.g., a lower error rate in their error test. Note that here they should first be sure 
that the modified QKD protocol is unconditionally secure even those assumed properties 
of physical channel don't exist. An unconditional secure protocol with certain conditional 
advantage is allowed in QKD. That is to say, after taking the modification, we expect certain 
advantageous result of the error test. In running the modified protocol, after the error test 
step, if Alice and Bob find that the result is close to their expected result, the advantage 
holds; if Alice and Bob find that the result is quite different from the expected one, the 
advantage is seriously undermined or even totally lost, but the protocol is still secure. In 
case they find the error test result quite different from the expected, their only loss is in the 
issue of key rate. Conditional advantage is useful if we have substantial probability that the 
error test result in QKD is close to the expected one. Although Eve may in principle do 
whatever to change the original physical properties, if Eve wants to hide her presence, she 
must not significantly change the error test result of the QKD protocol, since Alice and Bob 
will judge that there must be an Eve if their error test result is too much different from the 
expected result. Moreover, the final key rate is only dependent on the error test results rather 
than the full properties of the channel. If the QKD protocol itself is unconditionally secure, 
two different channels are equivalent for the QKD purpose provided that they cause the 
same error test result. This is to say, given an unconditionally secure protocol, if Eve hides 
her presence, Eve's action does not affect the error test result done by Alice and Bob, i.e., 
Eve's channel is equivalent to the supposed physical channel. The conditional advantage 
always holds if Eve hides herself. If Eve does not hide herself, she allows her action to cause 
the error test result much different from the expected one. This may decrease the final key 
rate, or even destroy the protocol if the error test result is too far away from the expected 
one. Even in such a case Eve cannot obtain a nonnegligible amount of information to the 
final key, given an unconditionally secure protocol. In this work, in evaluating the feasibility 
of our protocol, we only consider an invisible Eve, i.e., Eve always hides her presence. Note 
that no protocol can work as efficiently as it is expected with a visible Eve. A visible Eve 
can always destroy any protocol. 

We shall propose protocols with higher key rate and larger channel error rate threshold, 
given an asymmetric physical channel and invisible Eve. The key rate and channel error 
threshold of our protocol are dependent on the physical channel itself, but the security is 
independent of the physical channel, i.e., our protocols are unconditionally secure under 



whatever attack outside Alice's and Bob's labs. 

Most of the known prepare-and-measure protocols assume the symmetric channel to esti- 
mate the noise threshold for the protocol. Also, most of the protocols use the symmetrization 
method: Alice randomly chooses bases from certain set to prepare her initial state. All bases 
in the set is chosen with equal probability. In such a way, even the noise of the channel 
(Eve's channel) is not symmetric, the symmetrization make the error rate to the key bits 
be always symmetric. In this work we show that actually we can let all key bits prepared in 
a single basis and we can have advantages in key rate or noise threshold provided that the 
channel noise is asymmetric. 

II. CHANNEL ERROR, TESTED ERROR AND KEY-BITS ERROR 

Normally, Alice will transmit qubits in different basis (e.g., Z basis and X basis) to 
Bob, Bob will also measure them in different basis. The Hadamard transformation H = 

-± interchanges the Z-basis {|0), |1)} and A-basis {|±) = ^-(|0) ± |1))}. We 

shall use the term key bits for those raw bits which are used to distill the final key and 
the term check bits for those bits whose values are announced publicly to test the error 
rates. Our purpose is to know the bit-flip rate and phase-flip rate to key-bits. We do it in 
this way: first test flipping rates of the check-bits, then deduce the channel flip rate and 
then determine the error rates of key-bits. As it was shown in Ref[7(, the flipping rates of 
qubits in different bases are in general different, due to the basis transformation. Here we 
give a more detailed study on this issue. We first consider the 4-state protocol with CSS 
code, where only two basis, Z— basis and A— basis are involved in operation. For such a 
case of 4-state protocol, we define asymmetric channel as the channel with its bit flip error 
rate being different from its phase flip error rate. The check bits will be discarded after the 
error test. We use the term Z-bits for those qubits which are prepared and measured in 
Z basis, the term A-bits for those bits which are prepared and measured in X basis. For 
clarity we shall regard Alice's action of preparing a state in X basis as the joint actions of 
state preparation in Z basis followed by a Hadamard transform. We shall also regard Bob's 
measurement in X basis as the joint action of first taking a Hadamard transform and then 
taking the measurement in Z basis. Therefore we shall also call those Z-bits as J— qubits 
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and those A-bits as H-bits. To let the CSS code work properly, we need to know the value 

of average bit-flip rate and average phase-flip rate over all key bits. We define three Pauli 

matrices: 

'o l\ (o -i 

l oy I i o 

The matrix a x applies a bit flip error but no phase flip error to a qubit, a z applies a phase 
flip error but no bit flip error, a y applies both errors. We assume the a x ,a y , a z rates of the 
physical channel are q x o, q y Q, q z $ respectively. Note that the phase flip rate or bit flip rate of 
the channel is the summation of q z0 , q y0 or q x0 , q y0 , respectively. Explicitly we have 

PxO = qxo + QyO 

Pzo = q z o + q y o (1) 

Pyo = qxo + q z o (2) 

and q y o is defined as the channel flipping rate to the qubits prepared in F-basis (775 (|0) ± 
i|l))). After the error test on check bits, Alice and Bob know the value of p z o,p x o of the 
channel. Given the channel flipping rates q x o, q y o, q z o, one can calculate the bit-flip rate and 
phase-flip rate for the remained qubits. For those /—bits, the bit-flip rate and phase-flip 
rate are just q x $ + q y o and q z o + q y o respectively, which are just the channel bit flip rate and 
phase flip rate. Therefore the channel bit-flip rate p x $ is identical to the tested flip rate of 
/—bits. The channel phase-flip rate p z o can be determined by testing the flip rate of those 
//—bits. An H— qubit is a qubit treated in the following order 

prepared in Z basis, Hadamard transform, transmitted over the noisy channel, Hadamard 
transform, measurement in Z basis. If the channel noise offers a a y error, the net effect is 

«-"(")"•(:)■ 

This shows, the channel a y error will also cause a a y error to an H— qubit. Similarly, due 
to the fact of 

Ho~ z H = a x 
Ha x H = a z , (4) 

a channel a x flip or a channel o~ z flip will cause a net a z error or cr x error, to an H— bit. 
Consequently, a channel phase flip causes a bit flip error to H-bit, a channel bit-flip causes 



a phase flip error to H-bit. This is to say, the measured error of H-bits is just the channel 
phase flipping rate. Therefore the average bit-flip error rate and phase-flip error rate to each 
types of key bits will be 

p[ = Px = PzO, 
Pz =Pi= PxO (5) 

Here p x , p x {p^ , p z ) are for the bit flip (phase flip) error of iJ-bits and /-bits from those 
key-bits respectively Suppose the key bits consist of n J-bits and 1 — n if -bits, the average 
flip error of the key bits is 

Px = vpi + (1 - v)Pz = VPxo + (i - v)Pzo; 

Pz == VPl + (! - V)Px = VPzo + (1 - v)Pxo- (6) 

III. KEY RATE OF QKD PROTOCOLS WITH ONE WAY COMMUNICATION. 

We first consider an almost trivial application of our analysis of asymmetric channel 
above. In the standard BB84 protocol, since the preparation basis of key bits are sym- 
metrized, the average bit flip error and phase flip error to those key bits are always equal 
no matter whether the channel noise itself is symmetric or not. That is to say, when half of 
the key-bits are X-bits and Half of them are Z-bits, the average flip rates over all key bits 
are always 

Px =Pz = (Pxo+Pzo)/2- (7) 



Therefore the key rate for the standard BB8' 
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)rotocol (Shor-Preskill protocol) [13( with 
|, where H{t) = -(£log 2 £+(!-£) log 2 (l- 



whatever asymmetric channel is l — 2H( Px0 ~^ Pz0 ] 
£)). (Note that in the 4-state protocol, asymmetric channel is simply defined by p x o ^ p Z Q.) 
However, if all key bits had been prepared and measured in Z basis, then the bit flip and 
phase flip rates to key bits would be equal to those flipping values of the channel itself. In 
such a case the key rate is 

R=l-H(p x0 )-H(p z0 ). (8) 

Obviously, this is, except for the special case of p x0 = p z0 , always larger than the key rate 
in standard BB84 protocol with CSS code (Shor-Preskill protocol), where the key-bits are 
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prepared in Z-basis and X-basis with equal probability. For a higher key rate, one should 
always use the above modified BB84 protocol with all key bits prepared and measured in a 
single basis, Z-basis. 

In fact, this type of 4-satte QKD protocol with one single basis for key bits had been 
proposed already in the past for different purposes, see e.g., ref 17j|. 

Now we consider the case of 6-state protocol. In the standard protocol|5|, the key bits are 
equally distributed over all 3 different bases. In distilling the final key, each type of flipping 
error used is the averaged value over 3 bases, i.e., 

_ _ QxO + 2QzO - _ QxO + QzO + QyO - _ 1x0 + 2(^0 / n x 

Qx — — ^ — j iz — ^ , % — — 7, — • i y j 

The key rate is 

r = 1 - H (q) 
H(q) = ~q x log 2 q x - q y log 2 q y - q z log 2 q z - q I0 log 2 q I0 . (10) 

This is the key rate for standard 6-state protocol where we mix all qubits in diffent bases 
together. However, such a mixing is unnecessary. We can choose to simply distill 3 batches 
of final keys from Z— bits, X— bits and Y — bits separately. If we do it in such a way, the key 
rate will be increased to 



r 



' = 1 - q x0 log 2 q x o ~ q y o log 2 q y o - q z0 log 2 q z0 - qio log 2 q I0 . (11) 



Obviously, r' is never less than r since the mixing operation never decreases the entropy. 
The only case where r' = r is q x $ = q y Q = q Z Q. Therefore for a higher key rate, we propose to 
always distill 3 batches of final key separately. The advantage in such a case is unditional, 
there is no loss for whatever channel. Now we start to consider something more subtle: the 
advantage conditional on the prior information of the asymmetry property of noise of the 
physical channel. 

IV. 6-STATE PROTOCOL WITH 2- WAY CLASSICAL COMMUNICATIONS. 

The symmetric channel noise for a 6-state protocol is defined by q x o = q y o = qzo, if this 
condition is broken, we regard it as an asymmetric channel for 6-state protocols. In the 
standard 6-state protocolp, [D, [l6(, symmetrization is used, i.e., the key-bits are equally 



consisted by X—, Y-, Z— bits. When the channel noise itself is symmetric, i.e., q X Q = q y o = 
q z o, a 6-state protocol can have a higher noise threshold than that of a 4-state protocol. 
This is because in the 6-state protocol, the a y type of channel error rate is also detected. In 
removing the bit flip error, a y error is also reduced, therefore the phase-flip error is partially 
removed. However, in a 4-state protocol, a y error is never tested therefore we have to assume 
the worst situation that q y o = Op]]. 

We shall show that one can have a higher tolerable channel errors if one modify the 
existing protocols, given the asymmetric channel(i.e., the channel with its F-bits flipping 
error being different from that of X-bits or Z-bits.) For example, in the case that q y o = 
and q x0 = q z0 . The different types of error rates to the transmitted qubits are 

Qx — <?icCb Qy — 0, q z = q z o 

for those Z— bits; 

Qx = q z o, % = 0,q z = q x0 

for those X— bits and 

Qx = q z o, % = Qxo, q z = 

for Y — bits. The average error rates over all transmitted bits are: 

Qx = q,q y = g/3, q z = 2q/3, q = q x0 = q z0 - (12) 

With such a fact, the threshold of total channel noise q t o = JQ xO + Qyo + Qzo) for the protocol 
[161 ] is 41.4%, same with the case with symmetric noise 16 1. Actually, by our numerical 
calculation we find that the threshold of total channel noise for Chau protocol |l6| is almost 
unchanged with whatever value of q y o. However, if all key bits were prepared in Y — basis 
(the basis of {|y±) = -4=(|0) ± i|l))}), there would be no a z type of error therefore one only 
needs to correct the bit-flip error. To see this we can regard a Y — qubit as a qubit treated 
in the following order 
"prepared in Z basis, T transform, transmitted over the noisy channel, T~ l transform, mea- 

(i i) 

surement in Z basis. Here T — -m\ , it changes states |0, 1) into |y±). The following 

V 1 "V 

facts 

Ta x T~ l = a y ; Ta y T~ x = a z \ Tcr z T~ x = a x (13) 



cause the consequence that a channel flip of the type a x , a y , a z will cause an error to Y — bits 
in the type of o ,., a. respectively. With this faet, if the chapel error of P ,oJs 0, the „. 

type of error to the Y — qubit is also 0. Using the iteration formula given in Ref[16|, once all 
bit-flip error is removed, all errors are removed. Therefore the error rate threshold is 

Q X = Q Z = 25%, (14) 

i.e., a total error rate of 50%. In practice, it is not likely that a y type of channel flip is exactly 
0. Numerical calculation (Fig. 1) shows that, using Y — basis as the only basis for all key-bits 
always has an advantage provided that the channel flipping rate satisfies q y0 < q x0 = q z0 . 
For the purpose of improving the noise threshold, we propose the following protocol: 

1: Alice creates a random binary string b with (6 + 5)n bits. 

2: Alice generates (6 + 6)n quantum state according to each elements of b. For each bit in 
b, if it is 0, she produces a quantum state of either |0), or |+) or \y+) with probability 
1/4,1/4,1/2, respectively; if it is 1, she creates a quantum state |1), or |— ) or \y—) 
with probability 1/4, 1/4, 1/2, respectively. 

3: Alice sends all qubits to Bob. 

4: Bob receives the (6 + 5)n qubits, measuring each one in basis of either {|0),|1)} or 
{|±)} or {|y±)} randomly, with equal probability. 

5: Alice announces basis information of each qubits. 

6: Bob discards all those qubits he measured in a wrong basis. With high probability, 
there are at least 2n bits left (if not, abort the protocol). Alice randomly chooses n 
F-bits to use for the distillation of final key, and use the remained n bits as check bits. 
(Among all the check bits, approximately n/3 are A-bits, n/3 are Z-bits, and n/3 are 
F-bits.) 

7: Alice and Bob announce the values of their check bits. If too many of them are 
different, they abort the protocol. 

8: Alice randomly group the key bits with each group consisting 2 bits. Alice and Bob 
compare the parity values on each side to each group. If the values agree, they discard 
one bit and keep the other one. If the value disagree, they discard both bits of that 
group. They repeatedly do this for a number of rounds until they believe they can 
find a certain integer k so that both bit-flip error and phase-flip error are less than 5% 
after the following step is done. 
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9: They randomly group the remained key bits with each group consisting k bits. They 
use the parity value of each group as the new bits after this step. 
10: Alice and Bob use classical CSS code to distill the final key. 

Remark 1: Step 9 is to remove the phase flip error of the final key. Although in the extreme 
case that the phase flip error rate is always if initially the a y type of error is 0, however, 
in practice the initial a y type of error rate is not exactly 0. Even in the case the tested 
error rate on check bits is zero, we still have to assume a small error rate on the key bits to 
increase the confidence level. 

Remark 2: The above protocol is unconditionally secure. This means, under whatever type 
of intercept-and-resend attack, Eve's information to the final key is exponentially small. 
The security proof can be done through the purification and reduction procedure given 
by Ref.|l3J]. The only thing that is a bit different here is that Alice and Bob will take 
measurement in Y basis to make the final key, after the distillation. 

Remark 3: We don't recommend to use the above protocol blindly. Before doing the QKD, 
the users should test their physical channel and decide whether there is an advantage. 
Numerical calculation shows that, In the case of q X Q = q Z Q, q y o < q X Q, our protocol always has 
a higher error rate threshold than the corresponding 6-state protocol with key bits' bases 
equally distributed in all 3 bases. This fact is shown in Fig.(l). 

Remark 4: The conditional advantage require the users first test the properties of the physical 
channel before doing QKD. And we assume that the physical channel itself is stable. Note 
that we don't require anything for Eve's channel. As we have discussed in the beginning, 
physical channel is in general different from Eve's channel since Eve may take over the whole 
channel only at the time Alice and Bob do the QKD. However, if Eve wants to hide her 
presence, she must respect the expected results of the error test in the protocol. In our 
protocol, Eve's operation must not change the error rates of the physical channel, though 
she can change the error pattern. Since if these values are changed, Alice and Bob will find 
that their error test result is much different from the expected one therefore Eve cannot hide 
here presence. 

One may still worry whether the conditional advantage in our protocol is really useful, 
especially for the conditional threshold part. To make it clear, we consider a specific game. 
Suppose now Alice and Bob are prisoned in two separate places. They are offered a chance 
to be freed immediately. The rule is set as this: If they can make an unconditionally secure 
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final key, they will be freed immediately. If any third party obtained a non-negligible amount 
of information of the final key, they will be shot immediately. Suppose both Alice and Bob 
want to be freed immediately, but they take the value that being alive is more important 
than freedom[18|. The noise of the physical is known: the p y = 0;p x = p z = 22%. In such 
a case, those conditionally secure protocol with untestable conditions cannot be used, since 
those protocols will bring the risk to Alice and Bob of being shot. For example, protocol T 
is conditionally secure with individual attack, but we don't know how to see whether Eve 
has only used the individual attack. Even though T has a very large tolerable channel noise, 
Alice and Bob cannot use this protocol because they have a risk to be shot immediately. 
Previously known unconditionally secure protocols will not bring the risk of being shot to 
Alice and Bob, but those protocols cannot bring liberty to Alice and Bob, since none of 
them can tolerate such a high channel flipping error. However, the protocol in this work can 
help Alice and Bob to be freed without any non- negligible risk of being shot. In such a case, 
our protocol is the only protocol that may help Alice and Bob while all previously known 
unconditionally secure protocols cannot. 

Besides the advantage of a higher tolerable error rate, there are also advantages in the 
key rate of our protocol with asymmetric channel noise. Obviously, when the error rate 
is higher than other protocols' threshold while lower than our protocol's threshold, our 
protocol always has an advantage in key rate. More interestingly, even in the case that 
the error rate is significantly lower than the threshold of Shor-Preskill's protocol, we may 
modify our protocol and the advantage in key rate may still holds. We modify our protocol 
in such a way: take one round bit-error-rejection with two way communication and then use 
CSS code to distill the final key. As it was shown in Ref.jl6|, the various flipping rates will 
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change by the following formulas after the bit-flip-error rejection 
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(qio + Qzo) 2 + (qxo + Pyo) 2 ' 

Also, it can be shown that, the number of remained pairs is 

1 



tA- 



2 (qm + q z o) 2 + (Qxo + P y o) 2 
The key rate of our protocol is given by 

R = f -(l + q x log 2 q x + q y log 2 q v + q z log 2 q z + q T log 2 q T ) 



(16) 



(17) 



We shall compare this with the key rate of our modified six-state protocol where key bits 
are equally distributed over 3 different bases but we distill 3 batches of final key, i.e. 

r' = 1 + q x0 log 2 q x0 + q y0 log 2 q y0 + q z0 log 2 q z0 + q I0 log 2 q I0 . (18) 

We need not compare our results with the standard 6-state protocol [5j since its key rate given 
by eq. (|l()jl is superemed by eq. ljlljl . The numerical results are given in Fig. (2). 

V. SUMMARY 

In summary, We have shown that, given the asymmetric channel flip rate one can have 
advantages in tolerable flip rates and efficiency, if one uses a single basis for the key-bits. 
We have demonstrated this point by both 4-state protocol with CSS-code and the 6-state 
protocol with 2-way communication. It should be interesting to investigate the most general 
case that p x o,Pyo,p z o are all different for the case of 6-state protocol. 
Acknowledgement: I thanks Prof Imai H for support. Valuable conservations with H. F. 
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FIG. 1: Comparison of channel error threshold of different protocols. All values are in the unit 
of one percent. Qto is the threshold value of total channel noise given certain value of q y Q. In 
calculating Qto, we assume q x o = q z o- The dashed line is the threshold value of Chau protocol, the 
circled curve is the threshold of the six state protocol given in this work. 
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